Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

Looking for RedHat app and add-on recomendations.

0

Hello,

We are going to import RedHat web logs into Splunk for security monitoring. I was just wondering if anyone had any recommendations, based on your own experience, on apps I can use to make this process easier. So far, I've looked at Linux Auditd, Splunk App for Unix and Linux, and Red Hat Storage App for Splunk Enterprise (which I don't think fits my purposes). I just wanted to get other people's opinions on these apps, as well as hear any suggestions you have for alternatives.

If it matters, we are going to be using the logs for security, particularly in regards to detecting brute force attacks and privilege escalation.